| File name: | FluidSim.Spanish.Pack.by.CHEOPE.exe |
| Full analysis: | https://app.any.run/tasks/e6a879dc-2c96-4f90-9095-e510dae0da14 |
| Verdict: | Malicious activity |
| Analysis date: | October 17, 2024, 14:57:56 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5: | 00649B3FCEB4E5F79CD2F743F2C3A3F5 |
| SHA1: | 722F04ACEFDE755BA92525CD15C16EDBEAEE61AA |
| SHA256: | 4F4BCC3DC430E11B3DF3A4ADC9CD5D2D1EA08403217B770C3B632E8212A86B19 |
| SSDEEP: | 49152:lgoFFhBkfnyJgp+H2WZCcvMCIHPHeBg2Ua5/R+5N9OUO6vAJWRrAiAbLawj4h8:ltFzkfnggQ2WZC4qPHeBg2NH+tRO6v6h |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads the Internet Settings
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
Reads security settings of Internet Explorer
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
Reads Microsoft Outlook installation path
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
Reads Internet Explorer settings
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
Executable content was dropped or overwritten
- Festo FluidSIM v3.6.exe (PID: 2116)
- INS3EA4.tmp (PID: 900)
Process drops legitimate windows executable
- INS3EA4.tmp (PID: 900)
Starts application with an unusual extension
- Festo FluidSIM v3.6.exe (PID: 2116)
Reads the Windows owner or organization settings
- INS3EA4.tmp (PID: 900)
INFO
Checks proxy server information
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
Checks supported languages
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
- Festo FluidSIM v3.6.exe (PID: 2116)
- INS3EA4.tmp (PID: 900)
Reads the machine GUID from the registry
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
Reads the computer name
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
- INS3EA4.tmp (PID: 900)
Manual execution by a user
- Festo FluidSIM v3.6.exe (PID: 2644)
- Festo FluidSIM v3.6.exe (PID: 2116)
- fl_sim_p.exe (PID: 3912)
UPX packer has been detected
- FluidSim.Spanish.Pack.by.CHEOPE.exe (PID: 3700)
Create files in a temporary directory
- Festo FluidSIM v3.6.exe (PID: 2116)
- INS3EA4.tmp (PID: 900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | WinRAR Self Extracting archive (88.2) |
|---|---|---|
| .exe | | | UPX compressed Win32 Executable (4.6) |
| .exe | | | Win32 EXE Yoda's Crypter (4.5) |
| .dll | | | Win32 Dynamic Link Library (generic) (1.1) |
| .exe | | | Win32 Executable (generic) (0.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2004:12:26 15:34:28+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 5 |
| CodeSize: | 28672 |
| InitializedDataSize: | 8192 |
| UninitializedDataSize: | 110592 |
| EntryPoint: | 0x22a40 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
50
Monitored processes
8
Malicious processes
0
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 900 | C:\Users\admin\AppData\Local\Temp\INS3EA4.tmp /SL3 $1001BE "C:\Users\admin\Desktop\Festo FluidSIM v3.6.exe" 5496743 5500157 61952 | C:\Users\admin\AppData\Local\Temp\INS3EA4.tmp | Festo FluidSIM v3.6.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1580 | "C:\Users\admin\AppData\Local\Temp\FluidSim.Spanish.Pack.by.CHEOPE.exe" | C:\Users\admin\AppData\Local\Temp\FluidSim.Spanish.Pack.by.CHEOPE.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 2116 | "C:\Users\admin\Desktop\Festo FluidSIM v3.6.exe" | C:\Users\admin\Desktop\Festo FluidSIM v3.6.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 2472 | "C:\Program Files\Festo Fluidsim\bin\fl_sim_p.exe" | C:\Program Files\Festo Fluidsim\bin\fl_sim_p.exe | — | INS3EA4.tmp | |||||||||||
User: admin Company: Art Systems Software GmbH, Festo Didactic GmbH & Co. KG Integrity Level: HIGH Description: FluidSIM - Fluidics Simulation Program Exit code: 0 Version: 3, 6, 8, 0 Modules
| |||||||||||||||
| 2644 | "C:\Users\admin\Desktop\Festo FluidSIM v3.6.exe" | C:\Users\admin\Desktop\Festo FluidSIM v3.6.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 2872 | "C:\Program Files\Festo Fluidsim\bin\fl_sim_p.exe" | C:\Program Files\Festo Fluidsim\bin\fl_sim_p.exe | — | FluidSim.Spanish.Pack.by.CHEOPE.exe | |||||||||||
User: admin Company: Art Systems Software GmbH, Festo Didactic GmbH & Co. KG Integrity Level: HIGH Description: FluidSIM - Fluidics Simulation Program Exit code: 0 Version: 3, 6, 8, 0 Modules
| |||||||||||||||
| 3700 | "C:\Users\admin\AppData\Local\Temp\FluidSim.Spanish.Pack.by.CHEOPE.exe" | C:\Users\admin\AppData\Local\Temp\FluidSim.Spanish.Pack.by.CHEOPE.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3912 | "C:\Program Files\Festo Fluidsim\bin\fl_sim_p.exe" | C:\Program Files\Festo Fluidsim\bin\fl_sim_p.exe | — | explorer.exe | |||||||||||
User: admin Company: Art Systems Software GmbH, Festo Didactic GmbH & Co. KG Integrity Level: MEDIUM Description: FluidSIM - Fluidics Simulation Program Version: 3, 6, 8, 0 Modules
| |||||||||||||||
Total events
1 219
Read events
1 186
Write events
25
Delete events
8
Modification events
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyServer |
Value: | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyOverride |
Value: | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoConfigURL |
Value: | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoDetect |
Value: | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3700) FluidSim.Spanish.Pack.by.CHEOPE.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
40
Suspicious files
471
Text files
484
Unknown types
14
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\aq\is-RSU23.tmp | binary | |
MD5:EEFFC25435685E5AC19E23EE1843B717 | SHA256:E9826CC3FE2F07F20087056B35E7862E4F13B6C4C354EC926524F02FB5BF02BF | |||
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\bin\is-RCL4M.tmp | executable | |
MD5:929F6F961FB3EA09FC6007C30E8CACCB | SHA256:FC11D1637A4CA4560461CD0B434CC2E98D5B96770715D96EC9017BA884E056A0 | |||
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\bin\ad_anm.dll | executable | |
MD5:929F6F961FB3EA09FC6007C30E8CACCB | SHA256:FC11D1637A4CA4560461CD0B434CC2E98D5B96770715D96EC9017BA884E056A0 | |||
| 2116 | Festo FluidSIM v3.6.exe | C:\Users\admin\AppData\Local\Temp\INS3EA4.tmp | executable | |
MD5:EC2A3559EF793D976D3F72252ADE0B68 | SHA256:995CA25E8AC883429E67E2985887C2DC122E4D3CCA48D6AB5B545E6A896AE2E1 | |||
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\is-APSVR.tmp | executable | |
MD5:4430CC72B3A69E91F42043950461FBD1 | SHA256:50C32B8B80073C71DDDB3997B147E9903E60AC6EE5C25DF237BFCE83CBBDA646 | |||
| 900 | INS3EA4.tmp | C:\Users\admin\AppData\Local\Temp\is-MSHTK.tmp\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\aq\is-9SS1L.tmp | vc | |
MD5:451F0F3221A39D096614C2C6E8AB0928 | SHA256:8F31426003F743296E3B5FDC92E7DE584A0E01218F035CBAD551C3C926FFC988 | |||
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\aq\acp.kb | binary | |
MD5:EEFFC25435685E5AC19E23EE1843B717 | SHA256:E9826CC3FE2F07F20087056B35E7862E4F13B6C4C354EC926524F02FB5BF02BF | |||
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\aq\ep.kb | vc | |
MD5:451F0F3221A39D096614C2C6E8AB0928 | SHA256:8F31426003F743296E3B5FDC92E7DE584A0E01218F035CBAD551C3C926FFC988 | |||
| 900 | INS3EA4.tmp | C:\Program Files\Festo Fluidsim\bin\is-8PAE6.tmp | executable | |
MD5:C929E9E8275A2F88CDE936948034E7DF | SHA256:7B8BAF59C59A3B552F20C30CB3BD82E3EED88934AD9CB0E37F6E8856DF2FB91F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 239.255.255.250:3702 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |